Analysis
-
max time kernel
150s -
max time network
151s -
platform
ubuntu-20.04_amd64 -
resource
ubuntu2004-amd64-20240221-en -
resource tags
arch:amd64arch:i386image:ubuntu2004-amd64-20240221-enkernel:5.4.0-169-genericlocale:en-usos:ubuntu-20.04-amd64system -
submitted
05-05-2024 15:05
General
-
Target
183d0ea282492a70fa51aa0248023f85_JaffaCakes118
-
Size
28KB
-
MD5
183d0ea282492a70fa51aa0248023f85
-
SHA1
ff0f92d6164d64176a4771283919a1fafbe78679
-
SHA256
a24dfac6c6d11a578987098cae0d396bc3913eea1caa879c57951dd443060073
-
SHA512
bcb0ce02545ad8f622684f0d87d79d36fbafb6999f284a337673cfcecea8fcf507d91c90f91ccf4dde657b4fcb9ed396a9de708653832d6c2b1a8feaf6ef7cfb
-
SSDEEP
768:gCpuAWk6DW4lA4xC9lQg0uq0xm/jiggzHKRX:FpD/OW54xDL0xm/ezOX
Malware Config
Extracted
mirai
MIRAI
Signatures
-
Contacts a large (20600) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Modifies Watchdog functionality 1 TTPs 2 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
Processes:
183d0ea282492a70fa51aa0248023f85_JaffaCakes118description ioc process File opened for modification /dev/watchdog 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for modification /dev/misc/watchdog 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 -
Enumerates active TCP sockets 1 TTPs 1 IoCs
Gets active TCP sockets from /proc virtual filesystem.
Processes:
183d0ea282492a70fa51aa0248023f85_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 -
Enumerates running processes
Discovers information about currently running processes on the system
-
Reads system network configuration 1 TTPs 1 IoCs
Uses contents of /proc filesystem to enumerate network settings.
Processes:
183d0ea282492a70fa51aa0248023f85_JaffaCakes118description ioc process File opened for reading /proc/net/tcp 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 -
Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
Processes:
183d0ea282492a70fa51aa0248023f85_JaffaCakes118description ioc process File opened for reading /proc/2828/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/456/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/457/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2650/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/398/fd 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/1041/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2357/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2274/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2542/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2824/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/691/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/1908/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2142/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2189/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2369/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/504/fd 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/1028/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/1054/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/1464/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/1906/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2596/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/458/fd 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/503/fd 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/804/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2196/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2202/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2208/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2584/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2593/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/442/fd 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/458/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/483/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/3225/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/1037/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2252/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/3226/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/810/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/1462/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2183/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2194/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2353/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/270/fd 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/487/fd 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/614/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2490/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2306/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2350/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2562/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2604/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/500/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/578/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2235/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2379/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2656/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2785/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2804/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/397/fd 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/1505/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2184/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/1911/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/2519/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/3220/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/3234/exe 183d0ea282492a70fa51aa0248023f85_JaffaCakes118 File opened for reading /proc/545/fd 183d0ea282492a70fa51aa0248023f85_JaffaCakes118
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1468-1-0x0000000008048000-0x0000000008057840-memory.dmp